--- sourceDocument: Australia Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance Release : - australia ft:locale : - en-US ft:publication_title : - Australia Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # AI recommendations in privacy assessments # AI reviewer assist for privacy assessment tasks {#ariaid-title1} Release version: Australia Updated August 24, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of AI reviewer assist for privacy assessment tasks ServiceNow's AI reviewer assist enhances the privacy assessment process by automatically recommending relevant control objectives and risk statements for processing activities. This functionality applies after an assessment task moves to the Review state, where privacy analysts trigger AI recommendations to identify applicable controls and risks from existing libraries. It supports both standard and custom smart assessment templates without requiring manual mapping or preconfigured automation rules. Show full answer Show less ## Key Features * **AI-Assisted Recommendations:** Privacy analysts can generate suggestions for control objectives and risk statements based on completed assessment responses and processing activity details. * **Dual Recommendation Skills:** * *Control Objective Recommender:* Finds matching control objectives from the compliance policy library. * *Risk Statement Recommender:* Identifies relevant risk statements from the risk definition library. * **Retrieval-Augmented Generation (RAG) Approach:** Uses semantic matching and language models to analyze context and finalize relevant recommendations. * **Interactive Review:** Reviewers can accept, dismiss, or revert AI recommendations directly within the Recommendations tab in the assessment task. * **Applicable Scope Integration:** Accepted recommendations automatically populate the Applicable scope tab, consolidating records from AI, automation rules, or manual additions without duplicates. * **AI Suggestion Guide:** Each recommendation includes an explanation citing the specific assessment response or detail that triggered it, aiding reviewer understanding. * **Role-Based Access:** Specific roles (snprmgenai.user and snprivacy.analyst) control permissions for generating, reviewing, and managing AI recommendations and applicable scope records. ## Practical Outcomes for ServiceNow Customers * **Efficiency Gains:** Significantly reduces manual effort by automating identification of relevant privacy controls and risks, accelerating the assessment review process. * **Flexibility:** Supports custom assessment templates and questionnaires without needing manual configuration of automation rules, accommodating diverse organizational needs. * **Improved Accuracy and Traceability:** AI recommendation explanations help reviewers understand the rationale behind each suggested control or risk, promoting informed decision-making. * **Streamlined Compliance Management:** Automatically scoping accepted recommendations ensures privacy records are comprehensive and up to date, simplifying compliance tracking and reporting. Privacy analysts reviewing an assessment can use AI-assisted recommendations to quickly identify control objectives and risk statements that are most likely to apply to a processing activity. ## Overview of AI recommendations in privacy assessment tasks {#ai-reccos-for-pia__section_overview} Previously, control objectives and risk statements were mapped to assessment responses through automation rules in smart assessment templates. These rules were tied to the specific templates shipped with the product. Organizations that used custom templates or custom questionnaires had to manually configure these mappings. AI-assisted recommendations help address this limitation. After an assessment task moves to the Review state, the reviewer selects Recommend on the Overview tab to trigger the AI recommendation skills. These skills analyze the completed assessment responses and the associated processing activity, and then identify relevant control objectives and risk statements from the existing library. The reviewer can either accept or dismiss a recommendation. Accepted recommendations are added to the Applicable scope tab and automatically scoped to the processing activity when the assessment task closes. ## Key benefits {#ai-reccos-for-pia__section_benefits} AI-assisted recommendations provide the following benefits: * Reduces manual effort by automatically identifying relevant control objectives and risk statements from the library based on assessment responses. * Supports assessments built on smart assessment templates, including custom templates and questionnaires, without requiring preconfigured automation rules. * Provides an AI suggestion guide for each recommendation that explains why the record was recommended, citing the specific assessment response or record detail that triggered it. * Surfaces related control objectives that serve as mitigating controls for the recommended risk statements. {#ai-reccos-for-pia__ul_o2q_yx5_3kc} ## How recommendations are generated {#ai-reccos-for-pia__section_how_it_works} Two skills recommend control objectives and risk statements based on assessment responses: Control Objective Recommender : Surfaces matching control objectives from the compliance policy statement library. Risk Statement Recommender : Surfaces matching risk statements from the risk definition library. Each skill retrieves candidate records from an existing library using retrieval-augmented generation (RAG), then uses a language model to reason over the retrieved candidates and finalize a de-duplicated list. The RAG approach matches assessment content against the library. Here's how the skills generate recommendations. 1. Context is gathered from these sources: * Processing activity details, such as name and description. * Completed smart assessment responses, including information objects, data subject types and hierarchy. {#ai-reccos-for-pia__ul_rnj_zlz_3kc} 2. Based on this context, short retrieval texts are generated that represent distinct privacy obligations. 3. Each retrieval text is used to query the library for semantically similar control objectives or risk statements. 4. The retrieved candidates are evaluated, and the most relevant records are selected and displayed in the Recommendations tab of a privacy assessment task. {#ai-reccos-for-pia__ol_m13_3y5_3kc} ## Role requirements to generate recommendations {#ai-reccos-for-pia__section_e5d_n43_jkc} {#ai-reccos-for-pia__table_tc3_443_jkc__entry__2} | Role | Description | |-|-| | sn_prm_gen_ai.user | Enables privacy analysts to generate AI recommendations, view them in the Recommendations tab, and accept, dismiss, or revert recommendations on the assessment. | | sn_privacy.analyst | Enables privacy analysts to access assigned privacy assessment tasks from the Privacy Workspace and add or remove records from the Applicable scope tab. | [ ] {#ai-reccos-for-pia__table_tc3_443_jkc} ## Recommendations tab in a privacy assessment task {#ai-reccos-for-pia__section_where_recommendations_appear} On the Overview tab of a privacy assessment in Review state, the reviewer selects the Recommend button to generate AI recommendations. The Recommendations tab opens and displays the results on separate Control objectives and Risk Statements sub-tabs. The following image shows the Recommendations tab on a privacy assessment task.Figure 1. AI recommendation tab Note: If there's no relevant data available, the recommendations page indicates that the request was completed and there are no recommendations currently available. If the request is in progress, try reloading the page after some time. Each recommendation card in the New state displays the option to accept and dismiss it. After a reviewer accepts or dismisses a recommendation, the card displays the state as Accepted or Dismissed and offers a Revert option to reset the state. Accepted recommendations automatically reflect in the Applicable scope tab on the assessment task record. For details about the recommendation cards, see [AI-recommended control objectives](https://www.servicenow.com/docs/IC9HIk5sioMa9FSOmTvd6Q "Generate AI-assisted recommendations while reviewing a privacy assessment to quickly identify relevant control objectives from the privacy library.") and [AI-recommended risk statements](https://www.servicenow.com/docs/JWowalQQU6imsjNeVDEMJA "Generate AI-assisted recommendations while reviewing a privacy assessment to quickly identify relevant risk statements from the privacy library."). ## Applicable scope tab in a privacy assessment task {#ai-reccos-for-pia__applicable-scope-tab-pia} The Applicable scope tab lists all the records that apply to the processing activity. Records in this tab originate from three sources, identified by the Mode column.{#ai-reccos-for-pia__table_gwv_hbv_3kc__entry__2} | Mode | Description | |-|-| | Automated | Records added by smart assessment automation rules configured in the assessment template. | | AI-assisted | Records accepted from the Recommendations tab. | | Manual | Records added manually by the privacy analyst during review. | [ ] {#ai-reccos-for-pia__table_gwv_hbv_3kc} Reviewers can manually add and remove records from Applicable scope regardless of how they originated, including accepted AI recommendations and records added through automation rules. Note: If a recommended record is already in applicable scope from another mode such as automation, accepting the recommendation does not create a duplicate. The Mode column retains the value of the original source. If that record is later removed from the Applicable scope tab and the reviewer then accepts the same recommendation, the record is added back with AI-assisted as its mode. The summary cards for control objectives and risk statements in the Overview tab display the following counts: In scope : Total number of records in the Applicable scope tab, including accepted AI recommendations, records added by smart assessment automation rules, and records added manually by the reviewer. Selecting this count opens a list of all the records that are scoped to the processing activity. Recommended : Total number of control objectives or risk statements recommended by the AI skills. Selecting this count opens the Recommendations tab. Accepted recommendations : Number of AI-recommended records that the reviewer accepted. Selecting this count opens a filtered list of accepted recommendations. Auto-scoped by rule : Number of records added to applicable scope by smart assessment automation rules. Selecting this count opens a filtered list of records scoped by automation rules.